A different way to understand risk.
Most security tools focus on what happened. Calvyan helps organizations understand the context surrounding those outcomes.
Every incident has a backstory.
Long before a security incident occurs, there are often conditions that help shape the outcome: friction that encourages workarounds, hesitation that delays reporting, workload that reduces attention, or misalignment that weakens decision-making.
Security has invested heavily in understanding systems, controls, and alerts. Far less attention has been given to understanding the organizational conditions surrounding those outcomes.
Calvyan exists to help make those conditions visible.
Multiple perspectives. One organizational view.
How conditions are experienced.
How people experience policies, processes, communication, and day-to-day work provides important context for understanding organizational conditions.
How conditions are expressed.
Patterns and trends provide additional perspective on how conditions may be influencing outcomes.
How conditions are shaped.
Ownership, reporting relationships, decision-making structures, and other organizational factors influence how conditions develop over time.
The seven conditions.
The organizational conditions Calvyan evaluates.
How much the operating model slows work and encourages workarounds.
Whether concerns surface early and honestly, or arrive late and filtered.
The burden created by alerts, tools, and competing demands.
Patterns in everyday security-related behaviors across the organization.
How safe people feel raising concerns, challenging decisions, and sharing bad news.
How widely ownership of security and risk is shared across the organization.
Whether leadership priorities and security objectives reinforce one another.
Seven conditions selected because each can be understood, monitored, and improved over time.
What guides our approach.
Calvyan is designed to understand organizational conditions, not evaluate individual employees. Organizational understanding should never come at the expense of participant trust.
Meaningful understanding requires an honest view of organizational conditions. Elevated conditions are surfaced clearly, even when the findings are difficult or unexpected.
Measurement should support decisions. The goal is not simply to describe organizational conditions, but to help leaders understand where attention may be needed.
See the approach in practice.
Understand the conditions shaping security and risk outcomes in your organization.